Cyber Resilience

CVE-2026-40516

SSRF in Hkuds Openharness ≤ 2026-04-11

Public PoCSSRF
Published
17 April 2026
Modified
14 July 2026
Patch / advisory
CVSS Score v4 7.8
Click a component to see what it means
Raw vectorCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:H/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS Score 0.0018 8th percentile
Risk Priority 41 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2026-40516 is a high-severity SSRF (CWE-918) vulnerability in Hkuds Openharness. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified map to AC-4 (Information Flow Enforcement) and SI-10 (Information Input Validation) — see the control section below for these in your framework.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2026-40516 is a server-side request forgery (SSRF) vulnerability, mapped to CWE-918, affecting OpenHarness prior to commit bd4df81. The flaw exists in the web_fetch and web_search tools, which lack proper validation of target addresses, enabling requests to private and localhost HTTP services. Published on 2026-04-17, it carries a CVSS v3.1 base score of 8.3 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L).

Unauthenticated remote attackers can exploit the vulnerability by influencing an agent session to invoke the affected tools with manipulated parameters. This directs requests to loopback, RFC1918, link-local, or other non-public addresses, allowing attackers to read response bodies from local development services, cloud metadata endpoints, admin panels, or other private HTTP services reachable from the victim host.

Mitigation requires updating to OpenHarness commit bd4df81 or later, as detailed in the fixing commit at https://github.com/HKUDS/OpenHarness/commit/bd4df81f634f8c7cddcc3fdf7f561a13dcbf03ae and pull request https://github.com/HKUDS/OpenHarness/pull/92. Further analysis is provided in the VulnCheck advisory at https://www.vulncheck.com/advisories/openharness-ssrf-via-web-fetch-and-web-search.

OWASP Top 10 for Web (2025)

EU & UK References

Vulnerability Data

OpenHarness before commit bd4df81 contains a server-side request forgery vulnerability in the web_fetch and web_search tools that allows attackers to access private and localhost HTTP services by manipulating tool parameters without proper validation of target addresses. Attackers can influence an…

more

agent session to invoke these tools against loopback, RFC1918, link-local, or other non-public addresses to read response bodies from local development services, cloud metadata endpoints, admin panels, or other private HTTP services reachable from the victim host.

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-40503Same product: Hkuds Openharness
CVE-2026-40502Same product: Hkuds Openharness
CVE-2026-7551Same product: Hkuds Openharness
CVE-2026-40515Same product: Hkuds Openharness
CVE-2026-6729Same product: Hkuds Openharness
CVE-2026-6823Same product: Hkuds Openharness
CVE-2026-6819Same product: Hkuds Openharness
CVE-2026-32847Same vendor: Hkuds
CVE-2026-64626Shared CWE-918
CVE-2024-41570Shared CWE-918

Affected Assets

hkuds
openharness
≤ 2026-04-11

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V1.3.6
  • V1.5.3
  • V5.3.2
  • V10.4.7

Mitigating Controls (NIST 800-53 r5) AI

Information flow enforcement can restrict which destinations the server is allowed to contact on behalf of users.

Input validation directly stops untrusted URLs from being accepted and fetched without destination checks.

Boundary protection limits the network reach of server-initiated requests even if SSRF occurs.

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

DE.CM-09 partial match
prevents

Runtime monitoring of web applications and services can detect anomalous outbound requests indicative of SSRF.

ID.RA-01 partial match
prevents

Vulnerability identification processes can discover and record SSRF flaws in web applications.

PR.IR-01 partial match
prevents

Network segmentation and egress controls can limit the damage from successful SSRF requests.

PR.PS-06 partial match
prevents

Secure development practices directly include input validation and destination allow-listing that prevent SSRF.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

prevents

Operational threat data describing SSRF campaigns can be used to tighten outbound-request allow-lists and detection rules before attackers exploit them.

References